Analysis
-
max time kernel
107s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:26
Static task
static1
Behavioral task
behavioral1
Sample
po.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
po.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
po.exe
-
Size
450KB
-
MD5
210f27a2075e3f821cfb160cbfb851d4
-
SHA1
199bd194efdb4850c6f9b82f0ae250c8f0e6cc9e
-
SHA256
7850417d2c934eda23e7c968df7b7ef4d76c85328092b10826c3a8652388dba7
-
SHA512
dc62ab5e3bf8374af409c5caa95dc094cb3b0d487d91423ebebfbe3cca7293ff3166ad67c6805afe686367f2bb8dd05c28ae67349b032ce6aee7610e04aed06c
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.dianaglobalmandiri.com - Port:
587 - Username:
[email protected] - Password:
Batam2019
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2248-138-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
po.exedescription pid process target process PID 1336 set thread context of 2248 1336 po.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3252 2248 WerFault.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
po.exeRegSvcs.exepid process 1336 po.exe 1336 po.exe 1336 po.exe 1336 po.exe 2248 RegSvcs.exe 2248 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
po.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1336 po.exe Token: SeDebugPrivilege 2248 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
po.exedescription pid process target process PID 1336 wrote to memory of 4956 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 4956 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 4956 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 4228 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 4228 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 4228 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe PID 1336 wrote to memory of 2248 1336 po.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\po.exe"C:\Users\Admin\AppData\Local\Temp\po.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 15163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2248 -ip 22481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1336-130-0x00000000001B0000-0x0000000000226000-memory.dmpFilesize
472KB
-
memory/1336-131-0x00000000052D0000-0x0000000005874000-memory.dmpFilesize
5.6MB
-
memory/1336-132-0x0000000004C40000-0x0000000004CD2000-memory.dmpFilesize
584KB
-
memory/1336-133-0x0000000004BE0000-0x0000000004BEA000-memory.dmpFilesize
40KB
-
memory/1336-134-0x0000000008310000-0x00000000083AC000-memory.dmpFilesize
624KB
-
memory/2248-137-0x0000000000000000-mapping.dmp
-
memory/2248-138-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2248-139-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/2248-140-0x0000000006300000-0x0000000006350000-memory.dmpFilesize
320KB
-
memory/4228-136-0x0000000000000000-mapping.dmp
-
memory/4956-135-0x0000000000000000-mapping.dmp